ef : Approved Gx SUDUE DSB "ER Adpe4e008Sar000200080012-¢ 


ODP-81-437° 
21 April 1981 


MEMORANDUM FOR: Chief, Procurement Division, 
Office of Logistics 


FROM 


Chief, Management Staff, ODP 


SUBJECT 


Automatic Data Processing Equipment 
Procurement Policy (U) 


1. Automatic data processing equipment (ADPE) manufactured 
in a foreign country is becoming more and more common in the 


American marketplace and, hence, senior ODP managers are becoming 


increasingly concerned, for security reasons, about the possible 
introduction of foreign made ADPE into Central Intelligence 
Agency facilities. Two primary reasons for these concerns are 
physical security considerations and the potential requirement 
for visits to Central Intelligence Agency facilities by 
representatives of foreign vendors s 
engineers 


icult, complex engineering 
problems are encountered with ADPE manufactured in U. S., it 
usually is possible and sometimes necessary to bring design 
engineers to Headquarters to resolve the problems. However, it 
would not seem prudent to bring design engineers of foreign 
manufactured equipment into Agency buildings. Our security 
concerns, then include: 


° Alteration of equipment for surveillance or 
disruptive purposes during manufacture. 


° Embargo of spares, upgrades, engineering 
changes, or follow-on technology. 


° Alteration of equipment for surveillance or 
disruptive purposes during service 
(including modification of TEMPEST 
equipment). 
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° Difficulty in access to 
engineering/manufacturing personnel. 


° Possibility of having to utilize foreign 
national engineering/manufacturing 
specialists for maintenance of 
hardware/software. (C) 


2. Therefore, for security reasons, and with the 
concurrence of the Chief, Information Systems Security Group, 
Office of Security, we propose to establish the following policy 
regarding the procurement of ADPE for use in Office of Data 
Processing computing facilities. 


"It is the policy of the Office of Data 
Processing that automatic data processing 
equipment which is substantially of foreign 
manufacture will not be procured for use in 
Office of Data Processing computer 
networks." (U) 


3. Do you have any suggestions, for procurement reasons, 
that would strengthen this policy? (U) 
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